The invention is generally related to computers and computer software. More specifically, the invention is related to virus checking and scanning, and to computer database searching.
The amount and variety of information that can be accessed through a computer continues to increase at an astounding rate. The Internet, in particular, has enabled computer users to access a wide variety of information from other computers located all over the world.
As computers have become more and more connected to various information sources, however, computers have become increasingly at risk for contracting computer viruses. A computer virus can generally include any malicious or otherwise surreptitious computer program that xe2x80x9cinfectsxe2x80x9d a computer and performs undesirable activities in the computer. Some computer viruses are simply mischievous in nature; however, other viruses can cause a significant amount of harm to a computer and/or its user, up to and including stealing private data, deleting data and/or causing a complete computer failure. Some viruses even permit a third party to gain control of a user""s computer outside of the knowledge of the user, while others may utilize a user""s computer in performing other malicious activities such as launching denial-of-service (DOS) attacks against other computers.
Viruses can take many different forms, and can be spread in a wide variety of manners, e.g., as email attachments, macros or scripts, Trojan horses, worms, logic bombs, etc. (all of which, for the purposes herein, will be referred to hereinafter as xe2x80x9cvirusesxe2x80x9d). Often, a virus will hide, or xe2x80x9cinfectxe2x80x9d, an otherwise healthy computer program so that the virus will be activated when the infected computer program is executed. Viruses typically also have the ability to replicate and spread to other computer programs, as well as other computers.
To address the risks associated with viruses, significant efforts have been directed toward the development of anti-virus computer programs that attempt to detect and/or remove viruses that attempt to infect a computer. Such efforts have resulted in a continuing competition where virus creators continually attempt to create increasingly sophisticated viruses and anti-virus developers continually attempt to protect computers from new viruses.
One capability of many conventional anti-virus programs is the ability to perform virus checking on virus-susceptible computer files after such files have been received and stored in a computer, e.g., after downloading emails or executable files from the Internet. Server-based anti-virus programs are also typically used to virus check the files accessible by a server. Such anti-virus programs, for example, are often used by web sites for internal purposes, particularly download sites that provide user access to a large number of downloadable executable files that are often relatively susceptible to viruses.
Virus checking is often both processor- and bandwidth-intensive, and as a result, conventional anti-virus programs are typically limited to performing virus checks for files that are stored generally in the same computers upon which such programs are executing. Thus, while specific entities, including end users and web sites, may be capable of performing virus checking on files stored locally on those entities"" computers, oftentimes those entities are not capable of determining the viral risks associated with files under the control of other entities, at least not until such files can be retrieved and checked locally by an entity""s anti-virus program.
The distributed and decentralized nature of the Internet and other shared computer networks, in particular, highlights the aforementioned limitations of conventional anti-virus technologies, since oftentimes a user will navigate to a wide variety of web sites and be able to download virus-susceptible files from a large number of entities outside of the control of the user.
A particular example of the risks is in performing Internet-based searches and accessing search results generated thereby. Sophisticated search engines and associated xe2x80x9cportalxe2x80x9d sites have been developed by search providers for the express purpose of facilitating the location of web sites, pages and other files of interest to users. Many conventional search engines, for example, maintain index- and/or directory-based computer databases that attempt to catalog content on the Internet such that relevant web pages or other files may be identified to users in response to search requests sent to the search engines by such users. Often, such databases include a large number of records associated with different files such that the records, rather than the files themselves, are searched.
Search results are typically returned to a search engine user in the form of a formatted list of entries or records that are associated with files such as web pages that match a search request. Often, hypertext links are provided so a user can access the associated files by selecting the links. Given, however, that the files are often hosted and controlled by entities other than a search provider, the search provider typically has no mechanism for determining the virus risks presented by the files identified in search results sent to users of the search engine. As a result, files accessed through search engine results often present a comparatively higher degree of risk of infection to users. Particularly if a user is not using local anti-virus software, such a user is significantly at risk of contracting a virus.
The competition between commercial search providers, whether such providers provide searching sites or search engines used by others, has become relatively tight, and as a result, search providers are continuously attempting to increase the number of users of such services, particularly those where revenue is derived principally from advertisements or subscriptions. For example, many search sites attempt to add additional functionality and features to induce additional users to use their services.
Given the stiff competition between search providers, it would be highly detrimental for a search provider to be identified even tangentially as the source of a virus that performs mischief in a user""s computer. Nonetheless, given the lack of control that most search providers have over the files identified by the search results generated by such providers or their technology, often it is infeasible to create even a marginal level of trust that specific search results will not present a significant risk of infection to users.
The risks provided by Internet-based searching may also apply to other computer database searching environments, particularly where the possibility exists that files associated with certain search results will not be under the control of the entity that generates the search results. Therefore, a significant need exists in the art for a manner of decreasing the risks of viruses associated with accessing search results from computer database searches.
The invention addresses these and other problems associated with the prior art by providing in one aspect an apparatus, program product and method in which virus checking functionality is integrated into a computer database search environment to assist in protecting a user computer from contracting a computer virus when accessing search results. Specifically, consistent with the invention, the generation of a display representation of a result set generated in response to a search request is based at least in part upon virus status information associated with at least a portion of a plurality of result records identified in the generated result set.
Basing the generation of the display representation at least in part upon the virus status information permits the result set to be displayed in a manner that deters user selection of result records that may present a higher virus risk. For example (and it being understood that a wide variety of alternate operations may be performed), in some embodiments it may be desirable to simply omit displaying information related to result records found to present a virus risk, thereby effectively eliminating suspect search results from a result set. In the alternative, it may be desirable to highlight display information associated with suspect result records (e.g., with an icon or other distinct representation) to notify a user that such records present comparatively greater risks of viruses. Further, it may be desirable to highlight display information associated with trustworthy result records (e.g., with an icon or other distinct representation) to provide users with some assurance that particular records present comparatively lower risks of viruses. Other display options will be apparent to one of ordinary skill in the art having the benefit of the instant disclosure.
The invention also addresses additional problems associated with the prior art by providing an apparatus, program product, and method in which a first computer is configured to receive virus status information generated by a plurality of computers, with such received virus status information stored in a virus database that accessible by the first computer. As a consequence, multiple computers are capable of being relied upon to generate virus status information for use by a given computer, thereby permitting the responsibility for generating virus status information, as well as the processing horsepower required to generate the virus status information, to be allocated among the multiple computers. By distributing the virus checking responsibilities in this manner, a comparatively greater volume of virus status information may be generated and/or the timeliness of updates to existing virus status information may be improved.
These and other advantages and features, which characterize the invention, are set forth in the claims annexed hereto and forming a further part hereof. However, for a better understanding of the invention, and of the advantages and objectives attained through its use, reference should be made to the Drawings, and to the accompanying descriptive matter, in which there is described exemplary embodiments of the invention.